The California State Controller’s Office (SCO) has issued a warning about a phishing scam targeting unclaimed property holders. Fraudulent emails impersonating Controller Malia M. Cohen are requesting sensitive reporting data, including NAUPA files, UFS-1 forms, and property owner personally identifiable information (PII). Sovos clients should be vigilant and know how to recognize these scams.
What the Scam Looks Like
The fraudulent emails claim there were issues with a NAUPA file submission and request that holders resubmit documents via email, including copies of the UFS-1 form, Excel or PDF summaries of reported properties, and—most alarmingly—property owner email addresses. The messages create urgency by referencing approaching deadlines and “significant issues” requiring immediate attention.
Red Flags to Watch For
According to the SCO, these emails exhibit the following suspicious characteristics:
- Sender impersonation: The emails appear to come directly from Controller Malia Cohen. Legitimate unclaimed property communications will never come directly from the Controller.
- Fraudulent domain: The sender’s email address uses @sco-unclaimed.org. All legitimate SCO unclaimed property emails originate from @sco.ca.gov.
- Request for PII via email: The emails request names, addresses, SSNs, and email addresses in Excel format. The SCO will never request holders to report via Excel file sent through email.
- Urgency tactics: The emails emphasize urgency and approaching deadlines to pressure recipients into acting quickly without proper verification.
How California Actually Accepts Reports
The SCO urges all holders to submit unclaimed property report materials exclusively through the official report submission website: https://claimit.ca.gov/app/submit-a-report. Non-encrypted NAUPA files are accepted securely through this portal. The SCO will not accept password-protected files sent via email.
What To Do
- Do not respond to suspicious emails or forward them.
- Do not click on any links or open attachments in suspicious messages.
- Do not send sensitive materials, NAUPA files, or PII in response to unsolicited email requests.
- Verify independently by contacting the SCO through known, official channels before taking any action.
- Report exposure: If you have already provided unclaimed property data in response to a suspicious email, notify the SCO immediately at UPDHolderOutreach@sco.ca.gov or by phone at (916) 464-6088.
Stay Vigilant
Phishing attacks targeting unclaimed property compliance operations are becoming increasingly sophisticated. Always verify requests through official channels before responding, and when in doubt, contact your Sovos account team for guidance on proper reporting procedures.
